Death by downtime
summary
HelseID is Norway’s national OAuth2 hub that already secures prescriptions and patient APIs and aims for 99.9% availability while operating on a .NET stack with Duende IdentityServer. Design choices: strict OAuth2.1 profile, oversized nodes, multi‑data‑center redundancy (Frontline and Oslo) and in‑memory fallbacks so a DB outage degrades rather than stops service. Policies require clients to cache metadata for 24 hours and allow longer token lifetimes for emergency systems. Test environment mirrors production with 500k–1M tokens/week; no HelseID downtime so far and automated deployments ease failover.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:45About Udit
- 2:32About Rune
- 3:15About Doug
- 4:06About the company
- 5:35Health sector in Norway
- 6:07municipalities in Norway
- 6:38private sector
- 7:16laws regulations
- 8:13how do you solve this
- 10:33the loop
- 11:42timeline
- 15:44how it works
- 18:02what will happen
- 19:48plan B
- 20:52emergency access
- 21:28how to approach risk
- 26:34how healthy is built
- 34:17test environment
- 36:27operations
- 39:36dependencies
- 42:39policies
- 47:05future
- 49:27Summary
related talks
01h 03mHelseID
01h 00mHelseID Introducing Modern Web Security in a Geriatric Health Sector
59mOAuth2 on a national level - how to secure extremely sensitive apis
01h 01mSharing Health Information Through APIs
47mWho's your user? OpenID from the ground-up
28mBringing FIDO2 to National Identity
47mAuthentication and Authorization in the World of Media and Identity Providers
19mSecure Distributed Healthcare Systems with 99.97% Availability